When performing Manual or Scheduled Scan, SMEX adds timestamps for the scanned items. This timestamp is necessary to confirm whether a particular message is scanned or not. As an example, if you select the option "Scan messages that have not been scanned" on Manual Scan/Scheduled Scan, SMEX will check the timestamp to confirm whether the corresponding message has been scanned or not.

This behavior of adding a timestamp affects email backup and email archive. These features work based on the message's last changed time.

For Exchange 2013 or Exchange 2016:

• "AV stamp" on Transport level and store level.
  • On transport level real-time scan, after smex scans a message, it will add AV stamp. The AV stamps used by the Exchange Transport are stored in spoofing protected X-headers "X-MS-Exchange-Organization-AVStamp-Mailbox".
  • On manual/schedule scan, after smex scans a message, SMEX will add MAPI property "SMEX virus stamp" as the AV stamp.
  • Both of them are used when checking whether a message is scanned by SMEX or not.
• When manual/schedule scan is set to scan all messages, SMEX will add the "SMEX virus stamp" for all messages. So all message's last modified time will be changed.
  If manual scan is set to "only scan unscanned message", SMEX will only scan the messages that are not scanned by real-time scan or manual/schedule scan. And add the "SMEX virus stamp" for messages that doesn't have AV-stamp or "SMEX virus stamp". So the messages that have scanned before, the last modified time will not be changed.

For Exchange 2010:

• On transport level real-time scan, after smex scans a message, it will add AV stamp as the X-header "X-MS-Exchange-Organization-AVStamp-Mailbox".
• Exchange Store sets an AV stamp on a message or on a folder after manual/schedule scan.

According to the current situation, there is no workaround to avoid email time stamp changing by manual/scheduled scan. As a workaround, check if you can set to detect the receive time to archive the email.